Openzeplin/contracts package needs to be updated to 3.4.2. Please see https://forum.openzeppelin.com/t/timelockcontroller-vulnerability-post-mortem/14958